NAME¶

pki-server-kra - Command-line interface for managing PKI KRA.

SYNOPSIS¶

pki-server [CLI-options] kra-clone-prepare [command-options]
pki-server [CLI-options] kra-audit-event-find [command-options]
pki-server [CLI-options] kra-audit-event-enable [command-options] event-ID
pki-server [CLI-options] kra-audit-event-disable [command-options] event-ID
pki-server [CLI-options] kra-audit-event-modify [command-options] event-ID
pki-server [CLI-options] kra-audit-file-find [command-options]
pki-server [CLI-options] kra-audit-file-verify [command-options]

DESCRIPTION¶

The pki-server kra commands provide command-line interfaces to manage PKI KRA.

pki-server [CLI-options] kra [command-options]
This command is to list available PKI KRA management commands.

pki-server [CLI-options] kra-clone-prepare [command-options]
This command export KRA system certificates into a PKCS #12 file with private keys.

pki-server [CLI-options] kra-audit-event-find [command-options]
This command list all the audit events which are enabled/disabled.

pki-server [CLI-options] kra-audit-event-enable [command-options] event-ID
This command will enable audit events in the KRA.

pki-server [CLI-options] kra-audit-event-disable [command-options] event-ID
This command will disable audit events in the KRA.

pki-server [CLI-options] kra-audit-event-modify [command-options] event-ID
This command will modify the event filter for audit events.

pki-server [CLI-options] kra-audit-file-find [command-options]
This command lists audit logs generated by the KRA.

pki-server [CLI-options] kra-audit-file-verify [command-options]
This command will verify whether the signatures in the audit log files are valid.

AUDIT EVENTS¶

Logging audit events:

• AUDIT_LOG_STARTUP
• AUDIT_LOG_SHUTDOWN
• AUDIT_LOG_DELETE
• LOG_PATH_CHANGE
• LOG_EXPIRATION_CHANGE
• CONFIG_SIGNED_AUDIT

Authentication and authorization audit events:

• AUTHZ
• AUTH
• ROLE_ASSUME
• CONFIG_AUTH
• CONFIG_ROLE
• ACCESS_SESSION_ESTABLISH
• ACCESS_SESSION_TERMINATED

Key audit events:

• PRIVATE_KEY_ARCHIVE_REQUEST
• PRIVATE_KEY_ARCHIVE_REQUEST_PROCESSED
• PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_SUCCESS
• CONFIG_TRUSTED_PUBLIC_KEY
• PRIVATE_KEY_EXPORT_REQUEST_PROCESSED_FAILURE
• KEY_RECOVERY_REQUEST
• KEY_RECOVERY_REQUEST_ASYNC
• KEY_RECOVERY_AGENT_LOGIN
• KEY_RECOVERY_REQUEST_PROCESSED
• KEY_RECOVERY_REQUEST_PROCESSED_ASYNC
• KEY_GEN_ASYMMETRIC
• COMPUTE_SESSION_KEY_REQUEST_PROCESSED_SUCCESS
• COMPUTE_SESSION_KEY_REQUEST
• COMPUTE_SESSION_KEY_REQUEST_PROCESSED_FAILURE
• DIVERSIFY_KEY_REQUEST
• DIVERSIFY_KEY_REQUEST_PROCESSED_SUCCESS
• DIVERSIFY_KEY_REQUEST_PROCESSED_FAILURE
• SERVER_SIDE_KEYGEN_REQUEST
• SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_SUCCESS
• SERVER_SIDE_KEYGEN_REQUEST_PROCESSED_FAILURE

CMC audit events:

• CMC_RESPONSE_SENT
• CMC_ID_POP_LINK_WITNESS
• CMC_SIGNED_REQUEST_SIG_VERIFY
• CMC_PROOF_OF_IDENTIFICATION
• CMC_REQUEST_RECEIVED
• CMC_USER_SIGNED_REQUEST_SIG_VERIFY
• PROOF_OF_POSSESSION

Profile audit events:

• CONFIG_CERT_PROFILE
• CONFIG_CRL_PROFILE
• CONFIG_OCSP_PROFILE

Certificate audit events:

• CERT_SIGNING_INFO
• CERT_PROFILE_APPROVAL
• CERT_REQUEST_PROCESSED
• CERT_STATUS_CHANGE_REQUEST
• CERT_STATUS_CHANGE_REQUEST_PROCESSED
• CONFIG_CERT_POLICY
• PROFILE_CERT_REQUEST
• CIMC_CERT_VERIFICATION
• NON_PROFILE_CERT_REQUEST

ACL audit events:

•

CONFIG_ACL

OCSP audit events:

• OCSP_SIGNING_INFO
• OCSP_GENERATION

CRL audit events:

• SCHEDULE_CRL_GENERATION
• DELTA_CRL_PUBLISHING
• CRL_VALIDATION
• CRL_RETRIEVAL
• CRL_SIGNING_INFO
• FULL_CRL_GENERATION
• DELTA_CRL_GENERATION

Authority audit events:

• AUTHORITY_CONFIG
• SECURITY_DOMAIN_UPDATE
• CONFIG_DRM

Selftest audit events:

•

SELFTESTS_EXECUTION

Encryption data audit events:

• CONFIG_ENCRYPTION
• ENCRYPT_DATA_REQUEST
• ENCRYPT_DATA_REQUEST_PROCESSED_SUCCESS
• ENCRYPT_DATA_REQUEST_PROCESSED_FAILURE
• COMPUTE_RANDOM_DATA_REQUEST
• COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_FAILURE
• COMPUTE_RANDOM_DATA_REQUEST_PROCESSED_SUCCESS
• SECURITY_DATA_ARCHIVAL_REQUEST

Serial/random number audit events:

• INTER_BOUNDARY
• CONFIG_SERIAL_NUMBER
• RANDOM_GENERATION

SEE ALSO¶

pki-server(8)
PKI server management commands

AUTHORS¶

Amol Kahat <akahat@redhat.com>.

COPYRIGHT¶

Copyright (c) 2018 Red Hat, Inc. This is licensed under the GNU General Public License, version 2 (GPLv2). A copy of this license is available at ⟨http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt⟩.